Skip to content

Huda 1.1.0

Choose a tag to compare

View all tags
@devsolux devsolux released this 16 Oct 17:21
v1.1.0
ce81275

Huda 1.1.0 is a maintenance release of the source candidate: upgrade-safety, correctness and hardening fixes found in a multi-area review, plus a rustls security update. It is not a security-qualified release; packages remain unsigned or ad-hoc test candidates for Gatekeeper and SmartScreen.

Highlights

  • Upgrade-safe provider consent. Provider policies saved by 1.0.0 stay valid; their User-Agent version token now follows the running build instead of reading back as "not configured".
  • Relation identity. Relation types are stored under their registered key, so @01 and @1 no longer split one relation and hide a conflict.
  • Untrusted model and source input. Compound citations such as [R1, R99] are fully validated, model extraction cannot attach evidence, and the optional code adapter bounds destructuring-export extraction so hostile input cannot overflow the Core's stack.
  • Runtime robustness. The REST listener survives client resets, and a Core whose REST listener stops shuts down. An unlockable filesystem is no longer mistaken for a running Core or desktop, early Core exits are reported quickly, panicking MCP calls are answered, and the desktop offers Initialize profile again after an interrupted first run.
  • Dependencies. rustls 0.23.46 fixes RUSTSEC-2026-0346 to -0349 (low severity). No other lock entry changed, and cargo audit is clean.

See CHANGELOG.md for the full list.

Verify a download

Check the file against SHA256SUMS, then verify its Sigstore bundle with cosign 3.x:

cosign verify-blob --bundle "$FILE.sigstore.json" --certificate-identity "https://github.com/devsolux/huda/.github/workflows/desktop.yml@refs/tags/v1.1.0" --certificate-oidc-issuer https://token.actions.githubusercontent.com "$FILE"

A valid bundle shows which workflow run built the file. It is not a Developer ID, notarization or Authenticode signature.

Qualification

Executed on native macOS / Apple Silicon: formatting, strict Clippy, default, headless and all-feature tests, SQLite and desktop-asset checks, cargo audit and a locked release build. The release workflow builds, tests, packages and signs all four targets. Native installation, login, tray, secret-store and upgrade testing and the G0–G8 gates remain open; see docs/verification/gates.md.

Assets 14
Loading